Privacy Policy

1. Who is responsible for the data

Buddyvo is owned and operated by Melih Cansın Ercan, an individual based in Türkiye. For privacy questions and requests, email [email protected].

Legal review required: confirm whether an additional controller contact address, registered electronic mail address, or other statutory notice information must be published. No physical address is stated in this draft.

2. Information Buddyvo processes

• Account and authentication data: name, email address, phone number when provided, password hash, and identifiers associated with Apple or Google sign-in.
• Profile and discovery data: date of birth and derived age, gender, biography, roles, sports interests and goals, profile photos, swipe, like, match, bookmark, block, club, and event activity.
• Trainer and buddy data: qualifications, certificate images, experience, rates, workplaces, availability, training locations, reviews, and related interactions.
• Location data: foreground device coordinates and derived city, district, and country when location permission is granted. Exact coordinates may be stored to provide location-based discovery and matching.
• Messages and safety data: message text and images, conversation participants, delivery/read state, reports, block reasons, and up to the latest messages included with a safety report.
• Photos and moderation data: uploaded profile and chat images, plus moderation results such as approval status, risk level, confidence, labels, and face/person detection used to review image suitability.
• Subscription and transaction data: Apple product and transaction identifiers, subscription status, purchase, expiry, and revocation information.
• Notifications: push token, notification preferences, and notification delivery or processing status.
• Support data: the name, email, message, topic, and optional attachment submitted with a support request.
• Technical data: session and device information, IP address in server requests, request identifiers, security events, errors, and service logs.
• Website data: an email address submitted to the public waitlist and ordinary browser request information sent when website resources such as fonts are loaded.

3. How the information is used

Buddyvo uses the information above to create and secure accounts; provide profiles, discovery, matching, clubs, messaging, and support; calculate nearby results; moderate images and investigate reports; deliver notifications; verify Premium access; prevent abuse; operate and troubleshoot the service; and comply with obligations that apply to the service.

Legal review required: determine and document the applicable legal basis for every purpose, including any consent or other condition required for location, image/face analysis, direct marketing, and international transfers. This draft does not assert a legal basis that has not yet been approved.

4. Location

Buddyvo requests foreground location permission and may collect precise latitude and longitude together with city, district, and country. This information supports nearby profiles, trainers, gyms, clubs, and other location-based features. Device permission can be changed in operating-system settings, although features that require location may then be unavailable.

5. Profiles, photos, messaging, and safety

Information placed in a profile is shown to other users as required by discovery and interaction features. Profile and chat images are sent to AWS Rekognition for automated moderation before acceptance. Moderation can detect labels, moderation categories, faces, persons, and related attributes. Buddyvo stores the accepted image and its ordinary file metadata; the current profile-photo persistence does not store the detailed Rekognition result.

Direct messages are stored to provide conversations. If a user submits a safety report, the report can include the latest messages. Blocking and reporting data is used to enforce safety controls.

Legal review required: approve the legal basis, user notice, retention period, and any required human-review or appeal process for automated image moderation and safety decisions.

6. Premium subscriptions

On iOS, Premium purchases are processed by Apple. Buddyvo receives and verifies subscription and transaction information, but does not receive the user's full Apple payment-card details. Premium access is controlled by a server-verified active entitlement.

7. Service providers and recipients

The current product uses the following external services for the stated functions:

• Apple: Sign in with Apple, iOS in-app subscriptions, App Store server verification and notifications, and Apple platform notification delivery.
• Google: Google sign-in and Google Places gym search and suggestions. Sign-in data may include a Google account identifier, email, name, and available profile information; Places requests include the search text and location context supplied for the search.
• Expo: app build/update infrastructure, device location integration, and Expo Push Service. Push tokens and notification payloads are processed to deliver notifications.
• Amazon Web Services: Rekognition for image moderation. Image bytes are sent for the moderation operation.
• Formspree: collection of email addresses submitted through the public website waitlist form.
• Google Fonts: delivery of website fonts, which causes ordinary browser request data such as IP address and user-agent information to be sent to Google's font infrastructure.

Buddyvo also uses PostgreSQL, Redis, and S3-compatible object storage in its deployed infrastructure. The repository does not identify a final hosting provider or processing region, so none is claimed here.

8. Storage, retention, and account deletion

An authenticated user can request account deletion in the app. A recent reauthentication step is required. Deletion disables the account, removes direct identifiers and profile/product classifications, deletes active sessions, location, profile data, interests, matching activity, active club memberships, and the active Premium entitlement, and queues stored profile, chat, certificate, and support media for asynchronous deletion. Media deletion may complete after the database account deletion step and is retried when storage is temporarily unavailable.

Deletion uses a minimal pseudonymized tombstone rather than immediately removing every database row. Records needed for integrity, audit, transaction history, safety review, and technical processing can remain linked to this internal tombstone identifier. These may include subscription and transaction audit records, historical payment or booking records created before those features were disabled for the MVP, reviews, support records, deletion audit records, and minimum conversation structure.

For messages sent by a deleted account, chat media is removed promptly and the other participant may temporarily continue to see the transcript with the sender shown as “Deleted User.” Message content is retained for no more than 90 days after account deletion and is then replaced with a non-content placeholder. Message ordering, timestamps, and reply structure may remain. Automatic content removal may be deferred while a message is subject to an active safety-report legal hold.

Deleted data may remain in encrypted or access-controlled backups for the applicable backup lifecycle. Backups are not used to reactivate deleted accounts. If a backup is restored, available deletion and tombstone records are reapplied before the restored service is returned to normal use.

Deleting a Buddyvo account does not cancel an Apple subscription. The subscription must also be cancelled through the user's Apple account. A person may register again with the same sign-in identifier, but the new registration receives a new Buddyvo account identifier and an old subscription is not automatically attached to it.

Legal review required: approve specific retention periods for reports, logs, deletion audit records, subscription/transaction records, financial records, reviews, bookings, backups, and pseudonymized data. Also verify that nested payment payloads do not retain personal or health information longer than necessary.

9. International transfers

Apple, Google, Expo, Amazon Web Services, Formspree, or Google Fonts may process information in countries other than Türkiye depending on their service configuration and infrastructure.

Legal review required: confirm actual processing locations, applicable transfer safeguards, required user notices or consents, and contracts with each processor before release.

10. Your choices and rights

Users can edit available profile fields, change operating-system permissions, change notification preferences, block or report users, manage an Apple subscription through Apple, and request account deletion in the app.

You may contact [email protected] to request access, correction, deletion, restriction, objection, portability, or any other right available under the law applicable to you. The exact scope, exceptions, identity-verification process, and response period depend on applicable law.

Legal review required: finalize the jurisdiction-specific rights language and operational request procedure.

11. Age and children

Buddyvo is intended only for people who are at least 18 years old and is not directed to anyone under 18. A date of birth is checked during onboarding to enforce this minimum age requirement.

If you believe Buddyvo is processing information belonging to a person under 18, please notify us at [email protected]. We will review the report and handle the information as appropriate in light of the circumstances and applicable requirements.

12. Contact

Data controller and app owner: Melih Cansın Ercan
Country: Türkiye
Email: [email protected]